Railway attackers stole AI credentials and ran up $740,000 in charges
Original title: Hackers stole AI credentials to get $740,000 in free compute; Railway picked up the bill
The October 20 intrusion lasted about 26 hours and exposed variables in at most 1.85% of workspaces before eviction the next day.
Railway confirmed attackers exploited two previously unknown flaws in its build infrastructure, evading filesystem isolation and abusing a misconfigured trust relationship. They obtained an internal credential, copied source code, and decrypted customer environment variables, including AI provider keys later used for unauthorized model queries and training-data tasks. The company reset linked GitHub and OAuth tokens and is reimbursing customers for charges providers will not refund. It has rebuilt tooling and is moving to short-lived credentials.
Unconfirmed: Railway says the investigation is ongoing and it cannot confirm every attacker-created account or the full exploit scale.
- Database searches looked for AI provider keys before other credential types.
- Railway is reimbursing customers when AI providers decline to refund charges.
- Linked-account tokens for more than 1,850 users, including GitHub, were reset.
- Railway advises rotating secrets stored on the platform before October 21.
- Wiz found stolen keys tested within 30 minutes, then flooded days later.
Impact: Stolen AI and cloud credentials used for fraudulent compute
| Product | Affected |
|---|---|
| Railway | — |
- 1.Revoke and reapply sensitive environment variables stored on Railway before October 21.
- 2.Rotate AI provider, cloud, database, and payment credentials, starting with AI keys.
- 3.Check AI bills and GitHub, GitLab, and Docker Hub logs for unauthorized use.
- Victims
- Railway
From the original article
5 min read at csoonline.com
As AI model training and distillation increase, AI tokens are becoming a piping hot currency for threat actors. Cloud hosting provider Railway found out the hard way; it has confirmed a near 26-hour battle against attackers targeting AI provider credentials to sell to AI ‘transfer stations’ for use in model distillation.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.